Hacker News Reader

Comment by falcolas | Hacker News Reader

> what advice should I give to WordPress users to help them improve security

It requires a bit of knowledge and a commitment to managing the deploy, but: disable write permissions for the web user to the WordPress directory (excluding the upload folder), whitelist endpoints in nginx/apache, set up IP whitelists for /wp-admin/, minimize plugin usage.

This is going to reduce the user-friendliness of the WordPress install, but it's going to immediately increase the security by leaps and bounds. If you can't exploit plugins, can't access the admin pages, can't modify PHP files, and can't hit exotic endpoints, it's much harder to compromise WordPress.

View on HN

Or just let WordPress users just be users. Abstract the management of WordPress away from the CMS.

Have their access be just the content and limited/filtered by role. The built-in roles need virtually no tweaking.

We have our WordPress sites as git repositories and build via CircleCI, Ansible and Composer. For Multisite instances we use Composer and Satis and keep the themes in their own repositories and use tagged releases to manage our multisite build using CircleCI and Ansible again.

We use two-factor auth for Wordpress login (currently Duo on non-multisite installs). Nobody gets to install plugins. Nobody writes files into folders manually.

Minimal plugin usage is a solid recommendation.

How do you handle the database in your git Repositories? I'm asking because I never found a good solution for Version control of Systems like Joomla and WordPress. Optimally I'd like to be able to install and Setup a plugin on my Dev machine, then push that to production, as I would do with, for example a Rails App.

We only version the wp-content folder. We have automated db backups that we retain in multiple locations on a schedule.

Our hosts let us duplicate the db various ways between staging/prod and we just do a copy and search+replace for local development. We used to use WP DB Migrate Pro for that last part but it is buggy to the point of nonfunctional now.

So yes, you do have to do plugin setup/site configuration on dev, staging and prod. I don't see a good workaround for that, but the duplication of work leading up to production has allowed us to catch problems before hitting production.

Take a look at VersionPress.

Reply on news.ycombinator.com